That depends on the type of threat being protected against. If the threat is a mass exfiltration of passwords, this method will probably work fine since nobody

That depends on the type of threat being protected against. If the threat is a mass exfiltration of passwords, this method will probably work fine since nobody will bother trying to figure out that one weird trick to get this one person's passwords when there are a few million others to work on. If the threat is someone targeting you specifically, then you might need a better system.